use the strategy's oauth2 instance unless they client has specified a different refreshURL.
use the strategy's oauth2 instance unless they client has specified a different refreshURL.

klousiaj/passport-oauth2-refresh